Provenance & license

Provenance & license

Aarmos is an open spec, portable verifier, and closed product. You can verify supported Aarmos evidence with the applicable verifier and trust material, without contacting an Aarmos service.

This application

Copyright © 2026 Aarmatix LLC. All rights reserved. The Aarmos web application, runtime, policy engine, command line, adapters, and enterprise consoles are proprietary. Open components carry their own licenses (see below); everything else is covered by the Aarmatix commercial terms in the Terms of Service.

Open primitives

The licenses below identify the terms that apply to each work. A license does not by itself mean the work is currently publicly available; availability is stated separately.

  • @avar-standard/verify — reference receipt verifier (Apache-2.0; on public npm)
  • @avar-standard/core — receipt parsing & canonicalization (Apache-2.0; on public npm)
  • avar-spec — receipt & policy wire format (CC BY 4.0; not currently publicly published)
  • aarmos-invite-spec — invite envelope format (CC BY 4.0; not currently publicly published)
  • aarmos-bundle-spec — bundle format (CC BY 4.0; not currently publicly published)
  • @aarmos/starter-policies — signed starter policy bundles (Apache-2.0; not currently on public npm)

Distribution note: the @avar-standard/* packages above are publicly installable today. The current @aarmos/* Preview line is distributed to authorized workspaces as signed artifacts rather than through npm; a historical CLI version remains publicly resolvable. Licensing is unchanged by availability.

Proprietary distributions

The @aarmos/cli and @aarmos/bridge packages embed the Aarmos governance runtime — the decision semantics, policy evaluation, admission, delegation and evidence implementation. Those artifacts are proprietary and ship under LicenseRef-Aarmos-Proprietary. Earlier releases carried an Apache-2.0 notice that did not describe what the artifact contained; that notice is superseded from 1.0.0 onward, and those earlier versions have been unpublished or deprecated.

This changes nothing about the open components listed above, which keep their own licenses. A receipt written by Aarmos stays verifiable with the public @avar-standard/* packages whether or not you run anything of ours.

Verify a receipt yourself

The in-browser verifier runs the checks on-device with no Aarmatix service contacted, or use @avar-standard/verify from public npm in your own code.

Receipt build-provenance sidecar

A receipt can optionally be accompanied by a detached sidecar file, <receipt>.provenance.json, that records which build of the runtime produced it. The sidecar is written next to the receipt and is never embedded in it: strip the sidecar and the receipt remains a valid AVAR receipt that verifies exactly as before.

  • It carries build identity only — package, version, and the build attestation reference. It contains no per-device, per-user, or per-machine identifier.
  • Conformance is expressed as a scheme, a version, a profile, and a reference to the build attestation — not as a boolean "certified" flag.
  • It is advisory context for a reviewer. Verification of the receipt itself never depends on it.

Third-party notices

Aarmos uses open-source components under their original licenses (MIT, Apache-2.0, ISC, BSD). Licenses are retained in the shipped artifacts under node_modules/ at build time.

Last updated: August 8, 2026.

See also: Terms · Privacy · How-tos · Trust

Commercial inquiries: legal@aarmatix.com